Splunk Search

What is causing the Rex Raw c-ip syntax error?

brdr
Contributor

Hi,

I'm getting error at search time: Error in 'rex' command: Encountered the following error while compiling the regex '(?\d+.\d+.\d+.\d+)': Regex: syntax error in subpattern name (missing terminator)

My rex expression is this:

index=bcoat_eo | head 1 | rex field=_raw "(?\d+\.\d+\.\d+\.\d+)"

Blue log snippet is :

[18/04/2018:12:49:17 GMT] 12:49:17 time-taken=52 c-ip=173.18.293.215 sc-filter-result=OBSERVED

What am I doing wrong? Is it the '-' between the <>? If so how do i escape?

Thanks

0 Karma
1 Solution

brdr
Contributor

The command is:

index = bcoat | head 1 | rex field=_raw "(?<c-ip>\d+.\d+.\d+.\d+)"

blue coat log snippet is:
[18/04/2018:12:49:17 GMT] 12:49:17 time-taken=52 c-ip=173.18.293.215 sc-filter-result=OBSERVED

View solution in original post

0 Karma

elliotproebstel
Champion

Try replacing the hyphen with an underscore. It's not good practice to assign a field name in Splunk with a hyphen anyway. Do this instead:

index = bcoat 
| head 1 
| rex field=_raw "(?<c_ip>\d+.\d+.\d+.\d+)"
0 Karma

brdr
Contributor

The command is:

index = bcoat | head 1 | rex field=_raw "(?<c-ip>\d+.\d+.\d+.\d+)"

blue coat log snippet is:
[18/04/2018:12:49:17 GMT] 12:49:17 time-taken=52 c-ip=173.18.293.215 sc-filter-result=OBSERVED

0 Karma

brdr
Contributor

thank you!

0 Karma

elliotproebstel
Champion

Can you edit your post and wrap code and regex snippets with the code 101010 button or single backticks on each side? Some of the important part is getting eaten by syntax filters right now.

0 Karma
Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...